An Iran-aligned cyber hacking collective known as the Handala Hack Team has announced it successfully breached the personal mobile device of Herzi Halevi, the former Chief of Staff of the Israel Defense Forces, claiming to have exfiltrated upwards of 19,000 confidential files in the operation. In an official statement published to the group’s website on Thursday, the hackers revealed their infiltration of Halevi’s device was the result of a multi-year surveillance and cyber operation that granted them unfettered access to what they describe as thousands of sensitive images and video recordings from closed-door high-level security meetings.
In the bold statement, the group claimed that Israel’s most closely guarded national security assets — from top-secret military facilities and crisis command centers to operational strategic maps — have been fully exposed to their team for an extended period. The breach is being described as one of the most impactful cyber incidents targeting a senior leader in Israel’s national security establishment to date, with portions of the stolen data already circulated and reviewed by Middle East Eye. The released materials include visual evidence of previously unreported meetings between Halevi and Arab regional officials.
One undated photograph places Halevi alongside Michael Kurilla, the former head of U.S. Central Command (Centcom), at a meeting held in Qatar, where a large official portrait of Qatar’s ruling Emir Sheikh Tamim bin Hamad Al Thani is clearly visible in the background. A second undated image shows Halevi visiting the iconic Sheikh Zayed Grand Mosque in Abu Dhabi, United Arab Emirates, while a released video recording captures a meeting between Halevi and Jordan’s Chief of the General Staff, Yousef Huneiti, on Jordanian soil. In the video, Halevi presents Huneiti with a historic dagger that originally belonged to a Jordanian soldier killed during the 1967 Six-Day War, a symbolic gesture that had not been reported publicly prior to the breach.
Alongside the diplomatic and security-related materials, the hacking group also released personal content pulled from Halevi’s device, including private family photos, national identification cards for Halevi and his wife, and what the group frames as embarrassing personal moments. One short video shows Halevi hiding under a piano in a private living room as a woman enters the space.
The Handala Hack Team says it is withholding a large volume of additional stolen data that has not yet been made public, including further visual proof of unreported secret meetings, detailed Israeli military strategic maps, and personal identifying information for senior Israeli military commanders. The group warned in its statement that all of this unreleased material, which includes clear, unobscured imagery of senior Israeli military personnel and combat pilots, will be published incrementally at a future time of its choosing.
This cyber breach is not an isolated incident for the Handala Hack Team, which has built a track record of targeting high-profile Israeli political and security figures. Previous claimed attacks include a breach targeting former Israeli Justice Minister Ayelet Shaked and a senior aide to long-time Prime Minister Benjamin Netanyahu. Last year, the group claimed responsibility for hacking a personal device used by former Israeli Prime Minister Naftali Bennett, releasing hundreds of his private chat messages and a 141-page contact list that included contact details for multiple international heads of state and world leaders. Bennett acknowledged the breach of his Telegram account at the time, but noted that the released content included a mix of authentic and forged materials.
Herzi Halevi stepped down from his post as IDF Chief of Staff in March 2025, after leading Israeli military operations in the Gaza Strip through the first 17 months of the ongoing conflict. He assumed the role of army chief in January 2023, while Kurilla held his position as Centcom commander from April 2022 through August 2025, placing the Qatar meeting between the two leaders within the timeframe of January 2023 to August 2025.